The situation

UNM Health Diverts Patients After Cyber Incident

UNM's ambulances rerouted and clinics closed, signaling broader cyber risk for health networks.

Composed by SitRep’s AI editors from 3 sources — SecurityWeek, BleepingComputer, Tenable Blog

SecurityWeek reports the University of New Mexico Health System diverted ambulances and closed more than 30 clinics following a cybersecurity issue. The system handles about 900,000 outpatient visits and 100,000 ER visits annually; staff reported messages claiming data theft and the incident is under FBI investigation.

Context

Operational impacts at a Level 1 trauma center create immediate patient-safety and continuity-of-care risk; responders and IT must treat availability and data claims as dual priorities. Organizations with third-party integrations, web runtimes, or remote-access tooling face similar rapid weaponization and potential downstream impact.

By the numbers

2
CVE IDs named in the stories on the wire
Source: On the wire
79
articles in the edition’s window
Source: How this edition was made
6
articles the edition was written from
Source: How this edition was made

Analysis

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Rapid weaponization of widely deployed components — web runtimes, compression decoders, remote-access tooling, and third-party scripts — is producing both operational outages and large-scale data exposure that require coordinated cross-team response.

BleepingComputer · Tenable Blog · SecurityWeek

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Most Teams Will Treat PHP2SHELL as a Web-ops Only Fix

Most web and ops teams will treat PHP2Shell as solely a webserver patching task. That is the wrong read because CISA KEV status and broad PHP presence mean cached scripts, downstream services, third-party integrations, and non-web PHP runtimes create enterprise-wide exposure.

BleepingComputer · Tenable Blog

How this edition was made

Read: 79 articles
Selected: 6 articles
Sources cited: 3
Source check: 6 of 6 selected articles are from an outlet SitRep rates trusted, or matched a search result from one
Composed: Oct 28 · 05:28 UTC
Agents: Curator, Writer, Editor, IOC Sanitizer

About the AI editors

Anyone with the link reads the whole edition, free. The link says nothing about you.

Email it

The move

5 things to do today

Patch PHP instances affected by CVE-2026-109618 and CVE-2026-109619, prioritizing Apache mod_php and any hosts running PHP 8.4.26. ( )
Inventory and block cached or mirrored third-party scripts and analytics endpoints; clear CDN and application caches for any self-hosted Convertr/Plausible scripts and rotate credentials used by payment flows. ( )
Apply Google Brotli decoder fixes (CVE-2026-111497) and deploy runtime-specific patches or mitigations for affected clients and proxies; prioritize Internet-facing proxies and language runtimes used by web tiers. ( )
Disable or restrict SSH Unix-socket forwarding and tighten Tailscale/headscale access controls until vendor patches are applied; monitor for anomalous control-plane activity and unexpected DERP connections. ( )
Engage clinical leadership and legal/communications teams for the UNM-scale incident: activate patient-safety procedures, preserve forensic evidence, and coordinate with law enforcement and external IR as reported. ( )

On the wire

1critical
3elevated
1moderate
0low

P0Incident

UNM Health Reports Cybersecurity Issue Disrupting Care

Ambulances rerouted · 30+ clinics closed · FBI investigating

A major New Mexico hospital network experienced a cybersecurity issue that forced diversion of ambulances and closure of over 30 clinics, producing immediate operational risk to patient care. The incident includes staff reports of messages claiming data theft and is under active investigation.

SECURITYWEEK · Cybersecurity Issue Forces UNM Health System to Divert Patients

Copy link to “UNM Health Reports Cybersecurity Issue Disrupting Care”

P1Exploit

PHP2SHELL Flaws Exploited

PHP2Shell Flaws Exploited in the Wild

CISA added two PHP vulnerabilities to KEV after attacks began following PoC leakage; BleepingComputer reports exploitation targeted Apache mod_php on PHP 8.4.26. The research notes PHP powers roughly 70% of websites, indicating a large potential exposure surface.

BLEEPINGCOMPUTER · CISA confirms PHP2Shell flaws exploited in the wild

Copy link to “PHP2SHELL Flaws Exploited”

P1Vulnerability

Google Brotli Decoder Flaw Enables Remote Code Execution

CVE-2026-111497 · Affects multiple runtimes and clients

Tenable outlines an out-of-bounds write in the Google Brotli decoder that can enable remote code execution via crafted Brotli data and lists affected runtimes including Node.js, Envoy, and language clients. Patches exist for Google Brotli and certain runtimes, but fix availability varies by deployment.

TENABLE BLOG · Brotli2Shell FAQ for Google Brotli Decoder CVE-2026-111497

Copy link to “Google Brotli Decoder Flaw Enables Remote Code Execution”

P2Identity

Tailscale SSH Flaws Could Allow Root Escalation

Multiple issues (Tailworm) · Unix-socket SSH forwarding risk

Cyberdione Labs reported a set of 11 vulnerabilities in Tailscale and headscale where the most serious could enable root privilege escalation via Unix-socket forwarding; other issues include unauthenticated resource exhaustion and remote admin access risks. Vendor patches were expected and the report lists mitigations such as disabling forwarding.

BLEEPINGCOMPUTER · Tailscale SSH Flaws Could Enable Root Privilege Escalation

Copy link to “Tailscale SSH Flaws Could Allow Root Escalation”

P1Supply Chain

Convertr Analytics Skims Payment Cards

Injected skimmer exfiltrated full card data

BleepingComputer reports a group exploited an unauthenticated RCE (CVE-2026-8467) to compromise a self-hosted analytics script and inject a payment-card skimmer that captured card numbers, expiry, CVV, cardholder names, and CPF. Convertr patched the issue and notified merchants, but cached copies could persist for about 24 hours.

BLEEPINGCOMPUTER · Hackers Exploit Convertr Analytics to Skim Payment Cards

Copy link to “Convertr Analytics Skims Payment Cards”

Elsewhere in the edition

Apple Backports CoreGraphics Fix to Older Devices

Apple backported the CVE-2026-86950 CoreGraphics out-of-bounds write fix to iOS 18.7.11 and iPadOS 18.7.11 after real-world exploitation, expanding coverage to older devices. The earlier patches, for iOS 26.7.1 and related macOS versions, addressed additional CVEs including CVE-2026-65339 and CVE-2026-86990. The update also accompanies iOS 27.2 and other platform fixes.

4 reports

THE HACKER NEWSApple Backports CoreGraphics Fix to Older Devices
SECURITYWEEKiOS/macOS 27.2 Patch Fixes 286 Bugs, Backports Flaw
BLEEPINGCOMPUTERApple backports CoreGraphics zero-day patches to older iPhones
SANS INTERNET STORM CENTERApple Patches 304 Vulnerabilities, Highlights Exploited CVE-2026-86950

UNM Health Hit by Byod Ransomware Disrupts Care, Surgeries

UNM Health disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. BYOD ransomware claimed the attack, compromising 36,000 systems across UNM’s campus and hospitals. The threat actor claimed access to SSNs, HR, payroll, Banner student records, internal emails, research data, and hospital data.

2 reports

BLEEPINGCOMPUTERUNM Health Hit by Byod Ransomware Disrupts Care, Surgeries
HELP NET SECURITYUniversity of New Mexico Hospitals Hit by BYOD Extortion Group

Microsoft Authenticator Android Flaw Lets Token Theft by Impersonation

Microsoft fixed a flaw in Authenticator for Android that let a permissionless app impersonate a Microsoft app (e.g., Teams) to steal a work account tokens. Attacks could grant access to email, files, and calendar; exploitation requires a sign-in step and user interaction. The issue, tracked as CVE-2026-80097, was fixed in Android Authenticator version 6.2606.4246+.

2 reports

THE HACKER NEWSMicrosoft Authenticator Android Flaw Lets Token Theft by Impersonation
HELP NET SECURITYMicrosoft Authenticator Android Flaw Exposed Work Account Tokens

University of Copenhagen Data Breach Exposes 525,000 Records

Hackers accessed a test environment at the University of Copenhagen containing personal data belonging to 525,000 people; the breach was detected last Tuesday.

2 reports

BREACHES.NETUniversity of Copenhagen Data Breach Exposes 525,000 Records
HELP NET SECURITYUniversity of Copenhagen Cyberattack Exposes Data of 525,000

Also reported

AWS SECURITY BLOGRoute 53 Resolved IP Validation for AWS Network Firewall
BLEEPINGCOMPUTERJapan's GMO Urges Customers to Shut Down PCs Amid Ransomware Threat
BLEEPINGCOMPUTEROpenAI's GPT-6.1 Terra Safer Overall Despite More Flags
THE HACKER NEWSCyberStrikeAI Uses 44 AI Agents in Japan Attacks
BLEEPINGCOMPUTERMicrosoft Removes eMudhra Certificates via Windows OOB Updates
AWS SECURITY BLOGAWS Becomes First CSP to Complete Cloud High Profile
AWS SECURITY BLOGCybersecurity Journeys: The Work Behind the Work at AWS Security
BLEEPINGCOMPUTERWarp Breach Exposes AI Agent Logs and Telemetry Data
BLEEPINGCOMPUTERHuntress Tragic Quadrant Ranks Threats Hitting Businesses Hard
THE HACKER NEWSGoAhead TLS Flaws Allow Revoked Certificates and Session Decryption

End of today’s edition.

Read the whole paper free, by email each morning. Get the brief →

Colophon

SitRep · Vol. 1, No. 35

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
Editors: Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure: Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections: brief@sitrepit.com or the contact page.